Decentralized Machine Learning Across Similar Environments

1. A computer-implemented method comprising: identifying a plurality of computing networks by determining that each computing network of the plurality of computing networks satisfies a predetermined number of criteria, wherein determining that each computing network satisfies the predetermined number of criteria comprises determining a similarity score for each of the plurality of computing networks, wherein the similarity score is based on a weighted count applied to each of a set of features of the plurality of computer networks, the set of features including a number of network devices per role, a communication protocol or standard employed by each computing network, and network security features, and wherein the plurality of computing networks are selected based on the similarity score for each computing network satisfying a threshold value; providing a decentralized learning agent to each computing network, wherein the decentralized learning agent is provided with input parameters for training and is trained using training data associated with a computing network to which the decentralized learning agent is provided; obtaining a plurality of learned parameters from the plurality of computing networks, wherein each learned parameter of the plurality of learned parameters is obtained by training the decentralized learning agent provided to each respective computing network; and generating a global model based on the plurality of learned parameters.

2. The computer-implemented method of claim 1, wherein identical input parameters are provided to each decentralized learning agent.

3. The computer-implemented method of claim 1, wherein different input parameters are provided to at least two decentralized learning agents.

4. The computer-implemented method of claim 1, wherein determining that each computing network satisfies the predetermined number of criteria comprises comparing a number of satisfied criteria to a predetermined threshold value, and wherein each criterion is selected from a group of: a software configuration criterion, a hardware component criterion, and a software component criterion.

5. The computer-implemented method of claim 1, wherein the similarity score is one selected from a group including an integer value and a percentage value evaluated using the weighted count applied to each of the set of features.

6. The computer-implemented method of claim 1, further comprising: applying the global model to a target computing network to perform an anomaly detection task by comparing forecasted data generated by the global model to observed data of the target computing network.

7. The computer-implemented method of claim 1, wherein generating the global model comprises averaging corresponding learned parameters of the plurality of learned parameters.

8. An apparatus comprising: one or more computer processors; a network interface configured to enable network communications; one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising instructions to: identify a plurality of computing networks by determining that each computing network of the plurality of computing networks satisfies a predetermined number of criteria, wherein determining that each computing network satisfies the predetermined number of criteria comprises determining a similarity score for each of the plurality of computing networks, wherein the similarity score is based on a weighted count applied to each of a set of features of the plurality of computer networks, the set of features including a number of network devices per role, a communication protocol or standard employed by each computing network, and network security features, and wherein the plurality of computing networks are selected based on the similarity score for each computing network satisfying a threshold value; provide a decentralized learning agent to each computing network, wherein the decentralized learning agent is provided with input parameters for training and is trained using training data associated with a computing network to which the decentralized learning agent is provided; obtain a plurality of learned parameters from the plurality of computing networks, wherein each learned parameter of the plurality of learned parameters is obtained by training the decentralized learning agent provided to each respective computing network; and generate a global model based on the plurality of learned parameters.

9. The apparatus of claim 8, wherein identical input parameters are provided to each decentralized learning agent.

10. The apparatus of claim 8, wherein different input parameters are provided to at least two decentralized learning agents.

11. The apparatus of claim 8, wherein the instructions to determine that each computing network satisfies the predetermined number of criteria comprise instructions to compare a number of satisfied criteria to a predetermined threshold value, and wherein each criterion is selected from a group of: a software configuration criterion, a hardware component criterion, and a software component criterion.

12. The apparatus of claim 8, wherein the similarity score is one selected from a group including an integer value and a percentage value evaluated using the weighted count applied to each of the set of features.

13. The apparatus of claim 8, wherein the program instructions further comprise instructions to: apply the global model to a target computing network to perform an anomaly detection task by comparing forecasted data generated by the global model to observed data of the target computing network.

14. The apparatus of claim 8, wherein the program instructions to generate the global model comprise instructions to average corresponding learned parameters of the plurality of learned parameters.

15. One or more non-transitory computer readable storage media collectively having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to: identify a plurality of computing networks by determining that each computing network of the plurality of computing networks satisfies a predetermined number of criteria, wherein determining that each computing network satisfies the predetermined number of criteria comprises determining a similarity score for each of the plurality of computing networks, wherein the similarity score is based on a weighted count applied to each of a set of features of the plurality of computer networks, the set of features including a number of network devices per role, a communication protocol or standard employed by each computing network, and network security features, and wherein the plurality of computing networks are selected based on the similarity score for each computing network satisfying a threshold value; provide a decentralized learning agent to each computing network, wherein the decentralized learning agent is provided with input parameters for training and is trained using training data associated with a computing network to which the decentralized learning agent is provided; obtain a plurality of learned parameters from the plurality of computing networks, wherein each learned parameter of the plurality of learned parameters is obtained by training the decentralized learning agent provided to each respective computing network; and generate a global model based on the plurality of learned parameters.

16. The one or more non-transitory computer readable storage media of claim 15, wherein identical input parameters are provided to each decentralized learning agent.

17. The one or more non-transitory computer readable storage media of claim 15, wherein different input parameters are provided to at least two decentralized learning agents.

18. The one or more non-transitory computer readable storage media of claim 15, wherein determining that each computing network satisfies the predetermined number of criteria comprises comparing a number of satisfied criteria to a predetermined threshold value, and wherein each criterion is selected from a group of: a software configuration criterion, a hardware component criterion, and a software component criterion.

19. The one or more non-transitory computer readable storage media of claim 15, wherein the similarity score is one selected from a group including an integer value and a percentage value evaluated using the weighted count applied to each of the set of features.

20. The one or more non-transitory computer readable storage media of claim 15, wherein the program instructions further cause the computer to: apply the global model to a target computing network to perform an anomaly detection task by comparing forecasted data generated by the global model to observed data of the target computing network.